# Verify Points on curve secp256k1

I am trying to verify whether or not these points are on the secp256k1 curve.

I am finding several points included below.
(I have verified 2*G, 8*G and 10*G with the pycoin script)

My Questions are:

1. Did the sum of 2*G and inverse of 10*G come out correctly?
If so, I am confused, because I thought that each X-Coordinate only had 2 Y solutions. (+Y) and (-Y)

2. When I plug all of these points into the curve equation, they all appear to lie on the curve. If the Summation Point is not on the curve, can someone please walk me through how to properly figure out whether or not a point is on the curve?

(Hex, then Decimal format)
2*G
(x) : 0C6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE5
(y) : 1AE168FEA63DC339A3C58419466CEAEEF7F632653266D0E1236431A950CFE52A
(x) : 89565891926547004231252920425935692360644145829622209833684329913297188986597
(y) : 12158399299693830322967808612713398636155367887041628176798871954788371653930

10*G(inverse)
(x): 0A0434D9E47F3C86235477C7B1AE6AE5D3442D49B1943C2B752A68E2A47E247C7
(y): F76C545BDABE643D85C4938196C5DB3969086B3D127885EA6C3411AC4FC8C9729
(x): 72488970228380509287422715226575535698893157273063074627791787432852706183111
(y): -62070622898698443831883535403436258712770888294397026493185421712108624767191

Point Summation - 2*G + 10*G(Inverse)
(x): 2F01E5E15CCA351DAFF3843FB70F3C2F0A1BDD05E5AF888A67784EF3E10A2A01
(y): 0A3B25758BEAC66B6D6C2F7D5ECD2EC4B3D1DEC2945A489E84A25D3479342132B
(x): 21262057306151627953595685090280431278183829487175876377991189246716355947009
(y): 74042095941090708372193120377072390691273078602492804360923121318429259338539

8*G
(x)2F01E5E15CCA351DAFF3843FB70F3C2F0A1BDD05E5AF888A67784EF3E10A2A01
(y)5C4DA8A741539949293D082A132D13B4C2E213D6BA5B7617B5DA2CB76CBDE904
(x)21262057306151627953595685090280431278183829487175876377991189246716355947009
(y)41749993296225487051377864631615517161996906063147759678534462689479575333124

--I apologize for the lousy formatting on the large numbers. I couldn't figure out how to reduce the font size.--

• How you compute inverse of 10G? And how you sum them? Reponse to yours question - yes those coordinate are on the curve. Jan 27, 2018 at 13:13
• @MaartenBodewes I thought this question was posted on crypto.stackexchange. Also, I don't want to ask for an implementation, just if I am missing something by only plugging the points into the equation and making sure they equal each other. I guess unless someone says they aren't on the curve, then I'm doing it correctly. Jan 27, 2018 at 20:10
• I think perhaps I'm trying to pack too many questions into one "question". So, it sounds like your answer is saying that I did everything correctly, and the points do lie on the curve. If you could provide an explanation as to how we can have multiple values with the same X-Coordinate, I would accept it. Jan 27, 2018 at 20:13

## 2 Answers

Your computations are correct.

For each valid $x$ coordinate there are 2 valid $y$ coordinate, $+y$ and $-y$, as you correctly said.

But note that numbers in a field $\mathbb{F}_p$ are usually written $\mod p$, which means they lie in the interval $[0,p-1]$, so without the "-" sign.

So, when you write the $y$ coordinate of your $-10G$, which you call $10*G (Inverse)$ but obviously $10*(-G)=-10*G$ so it's equivalent, you write it as: -62070622898698443831883535403436258712770888294397026493185421712108624767191 but this can be written as a field element as
p - 62070622898698443831883535403436258712770888294397026493185421712108624767191 with $p$ being the prime defining the field. This results into 53721466338617751591687449605251649140499096371243537546272162295800209904472 .

Plugging the coordinates into the curve's equation is the correct way to verify that points are on the curve, and yours are on the curve.

For example: your $2G-10G$ and $8G$ share the same $x$ coordinate, in fact, $2G-10G=-8G$ so they are opposite points. You can get the value of the $y$ if you subtract one's value from $p$. E.g.

p - 41749993296225487051377864631615517161996906063147759678534462689479575333124
= 74042095941090708372193120377072390691273078602492804360923121318429259338539


According to this EllipticCurve code repo, you can validate a point is on the curve with the following function:

    public bool IsPointOnCurve(EllipticCurvePoint point)
{
if (point == EllipticCurvePoint.InfinityPoint)
{
return true;
}

BigInteger y = point.Y;
BigInteger x = point.X;
BigInteger a = this.A;
BigInteger b = this.B;
BigInteger p = this.P;

var rem = (y * y - x * x * x - a * x - b) % p;

return rem == 0;
}


Plugging in your point coordinates, it looks like it's on the curve alright:

+       y   {41749993296225487051377864631615517161996906063147759678534462689479575333124} System.Numerics.BigInteger
+       x   {21262057306151627953595685090280431278183829487175876377991189246716355947009} System.Numerics.BigInteger
+       a   {0} System.Numerics.BigInteger
+       b   {7} System.Numerics.BigInteger
+       p   {115792089237316195423570985008687907853269984665640564039457584007908834671663}    System.Numerics.BigInteger
+       rem {0} System.Numerics.BigInteger